Penetration Testing
Pentesting that finds what scanners miss
What a Sayfer pentest covers
Every engagement is manual, led by senior researchers, and documented so an external auditor or enterprise client can rely on it. The scope is tailored to your product:
- Web applications and APIs, including the business logic that automated tools cannot understand
- Authentication, authorization, session management and tenant isolation
- Mobile applications, iOS and Android
- Network and infrastructure layers, internal and external
- OWASP Top 10 and OWASP WSTG v4.2 methodologies, mapped to SOC 2, ISO 27001, HIPAA and PCI DSS where needed
How a pentest runs
- Step 1Introduction. Meet the team, tell us about your product, and we identify critical risks, timeframes and goals together.
- Step 2Quote. A detailed price quote covering scope, milestones and deliverables.
- Step 3Testing. Manual penetration testing by senior researchers. Critical findings are reported as we find them, not at the end.
- Step 4Results. A report your developers can act on: reproduction steps, risk rating and a concrete fix for every finding.
- Step 5Unlimited retests. After your fixes are in, we retest until every finding is confirmed closed.
- Step 6Certification. A Sayfer certificate you can show to clients, investors and auditors.
2-4 weeks from kickoff to a full report.
Real researchers, not scanners
Our research team is credited with three CVEs in Kaspersky's TinyCheck, two of them rated critical. That depth is what your pentest gets: people who find what automated tools miss.
Want proof before a call?
We publish real deliverables with client details redacted, including a full web platform pentest report. Download one and compare it to any report you have received before.
Get your pentest quote
Tell us what you are protecting and we will scope it together.
Common questions
How long does a pentest take?
2-4 weeks from kickoff to a full report, depending on scope. Critical findings are reported as soon as we find them, so your team can start fixing immediately.
Black-box or white-box?
Both. Black-box simulates an external attacker with no access. White-box, with credentials and documentation, goes deeper into business logic. We usually recommend a mix, decided together during scoping.
Will the report satisfy SOC 2 or ISO 27001?
Yes. Findings are mapped to the frameworks you target, and the report is written for external auditors. For SOC 2 specifics, see our SOC 2 penetration testing page.
Are retests included?
Yes, retests are unlimited. After you implement the fixes, we retest every finding until it is confirmed closed and issue a closure confirmation you can show to auditors and clients.
